In this paper we present lightweight model-based testing of privacy and authorization concepts of national portal for electronic health services in Norway (which has over a million of visits per month). We have developed test models for creating and updating privacy levels and authorization categories using finite state machine notation. Our models emphasize not only positive but also negative behavioral aspects of the system. Using edge and edge-pair coverage as an acceptance criteria we identify and systematically derive abstract test cases (high level user scenario) from the models. Abstract test cases are further refined and transformed into concrete test cases with detailed test steps and concrete test data. Although derivation of abstract test cases and their transformation into concrete test cases are manual, execution of concrete test cases and generation of test report are automated. In total, we extracted 85 abstract test cases which resulted in about 80 concrete test cases with over 550 iterations. Automated execution of all test iterations takes about one hour, while manual test of one iteration takes about five minutes (over 40 times speedup). Model-based testing contributed to shift the focus of our intellectual work effort into model design rather than test case design, thus making derivation of test scenarios systematic and (relatively) straight forward. In addition, applying model-based testing augmented and extended our traditional quality assurance techniques by facilitating better comprehension of new privacy and authorization concepts. Graphical models helped on improved understanding of textual specifications.